The Internet and the World Wide Web (“Web”) have changed the landscape of information delivery and affected numerous aspects of life. One benefit of this technological development is the ability to conduct business transactions globally via the Internet. As the volume of commerce conducted over the network continues to increase, collections of business units or organizations are working together to pool resources and expertise in order to achieve a common business objective. Organizations are sharing services and resources across enterprise boundaries in order to undertake collaborative projects that they could not undertake individually, or to offer composed services that could not be provided by individual organizations.
A growing array of technologies has emerged to help bridge the gaps between people, time and geography in such collaborative environments. These include both synchronous and asynchronous technologies such as email, web conferencing and instant messaging. These technologies often include the ability to display and share application files. Presentations, spreadsheets and documents are shared among participants without requiring the participants to have these files individually installed on their system.
However, such online collaboration is threatened by security issues such as data eavesdropping, data tampering and entity repudiation. Often, customer information and financial account numbers are stolen through data eavesdropping, whereby data remains intact but privacy is compromised. In a data-tampering event, the data is altered or replaced in a transaction. For example, someone can change the amount to be transferred to and from a bank account. In entity repudiation, the identity of the participant is compromised. Often, data is passed to a person who poses as the intended recipient.
Many security and trust management technologies have been developed to address the demand for secured online collaboration. One common security approach includes using the Public Key Infrastructure (PKI), which is the standard for public-key cryptographic security and is used to ensure the security of digital certificates. PKI infrastructure provides these security measures—user authentication, data integrity and confidentiality. With the PKI infrastructure, a pair of keys is used to provide strong authentication and encryption services. The key pair is associated with a user by the use of a certificate containing the user's public key and attributes associated with the user. Often, the certificate is digitally signed by a trusted third party, such as the Certification Authority (CA), and is valid only for a certain period of time. The public key associated with and certified by the certificate works with the corresponding private key possessed by the entity identified by the certificate. The PKI infrastructure is able to verify the identities of the participants through the certificate and maintain data integrity with the encryption technology.